Newsletter Archives

• US CERT and KB 2963983: Don’t use drive-by-enabled Internet Explorer

  Posted on April 28, 2014 at 15:24 CDT by woody • Comment in the Forums

  There’s another 0day on the loose. But you use Chrome or Firefox anywya, right? Right?

  InfoWorld Tech Watch.

  Windows Patches/Security Internet Explorer 0day

• New IE patch MS12-063

  Posted on September 22, 2012 at 08:21 CDT by woody • Comment in the Forums

  There’s an(other) emergency out-of-band patch for Internet Explorer. Gregg Keizer has a full write-up on Computerworld.

  “Because IE10 was not affected by the recent zero-day vulnerability, Storms suspected that Microsoft may have known of the flaw before it publicly surfaced. That would go a long ways in explaining the speed with which it fixed the bug.”

  Indeed.

  I’m going to install the new patch on my machines, and recommend that you do the same – but I’m not in a big hurry about it. Why? Because I us Firefox as my main browser, haul out Chrome when I need to look at a site with Flash, and save Internet Explorer for the rare occasions when I need the compatibility.

  Windows Patches/Security Internet Explorer 0day, KB 2744842, MS12-063

• Internet Explorer 0day

  Posted on September 18, 2012 at 23:05 CDT by woody • Comment in the Forums

  Microsoft has warned about a newly discovered, not-yet-fixed hole in Internet Explorer, all versions (except IE 10).

  There’s a thorough discussion on Brian Krebs’s site.

  Smartest approach? Don’t use IE. Switch to Firefox or Chrome. Nod if you’ve heard that one before.

  Windows Patches/Security Internet Explorer 0day

• What Microsoft didn’t say about the new 0day Windows flaw

  Posted on February 1, 2011 at 03:37 CST by woody • Comment in the Forums

  Casting blame on Windows, when Internet Explorer is at fault.

  See my latest InfoWorld Tech Watch blog.

  Windows Patches/Security Internet Explorer 0day

• Yet another Internet Explorer 0day

  Posted on January 29, 2011 at 13:21 CST by woody • Comment in the Forums

  Microsoft has released Security Advisory 2501696, describing yet another 0day flaw in Internet Explorer.

  This time the problem lies in the way IE handles MHTML code. Apparently there’s a way for a sufficiently ornery Web page to run amok on your PC, if you’re browsing with Internet Explorer. No action on your part necessary; it’s a drive-by security hole.

  You have two choices.

  You can either run Microsoft’s Fixit, which sits in Knowledge Base article 2510696.

  Or you can do what I’ve been begging you to do for almost a decade now. Use Firefox. Or Chrome. Or Safari. Or anything except Internet Explorer.

  Windows Patches/Security Internet Explorer 0day, KB 2501696

• Chinese activist attacks based on Internet Explorer 0day?

  Posted on January 15, 2010 at 07:32 CST by woody • Comment in the Forums

  Brian Krebs reports that the attacks on Chinese human rights activists that I talked about a couple of days ago – the attack that led Google to finally take a stand in support of basic human dignity over corporate profits – was made possible by my favorite security whipping boy, Internet Explorer.

  Microsoft has confirmed the 0day hole in Security Advisory 979352.

  It looks like the IE 0day is only part of the story, though. The attacks were made possible by a smorgasbord of 0day holes. Researchers are still looking at all of the problems.

  The Washington Post (now without Krebs) says that the Google attack is much larger than originally thought:

  Computer attacks on Google that the search giant said originated in China were part of a concerted political and corporate espionage effort that exploited security flaws in e-mail attachments to sneak into the networks of major financial, defense and technology companies and research institutions in the United States… At least 34 companies — including Yahoo, Symantec, Adobe, Northrop Grumman and Dow Chemical — were attacked, according to congressional and industry sources.

  The bottom line for home users is pretty simple: the bad guys aren’t out to get you, and at the moment you don’t have anything to worry about. These are sophisticated, targeted attacks that haven’t yet made it out into the general population.

  But remember who’s behind it, and why, OK?

  Windows Patches/Security Google, Internet Explorer 0day